)]}'
{"doc/source/specs/mac_spoofing.rst":[{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"1923f8ff7b3a7bb33198db15643690057c7416e3","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":"In current Neutron implementation MAC spoofing protection rules are added"},{"line_number":19,"context_line":"implicitly to each port, these rules are not part of the security groups"},{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With out MAC spoofing protection a VM in a network can pretend and answer"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa69d971_4672fc4a","line":19,"range":{"start_line":19,"start_character":18,"end_line":19,"end_character":19},"updated":"2016-01-03 12:50:59.000000000","message":"VM port ?","commit_id":"0964e387e14f47d8abfc201837e4c65eccdc22c5"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"fe4b96a8b554d6328e72b36a393db89986499c70","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":"In current Neutron implementation MAC spoofing protection rules are added"},{"line_number":19,"context_line":"implicitly to each port, these rules are not part of the security groups"},{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With out MAC spoofing protection a VM in a network can pretend and answer"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa69d971_49e3ef33","line":19,"range":{"start_line":19,"start_character":18,"end_line":19,"end_character":19},"in_reply_to":"fa69d971_4672fc4a","updated":"2016-01-03 14:04:46.000000000","message":"Done","commit_id":"0964e387e14f47d8abfc201837e4c65eccdc22c5"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"1923f8ff7b3a7bb33198db15643690057c7416e3","unresolved":false,"context_lines":[{"line_number":19,"context_line":"implicitly to each port, these rules are not part of the security groups"},{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With out MAC spoofing protection a VM in a network can pretend and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"},{"line_number":24,"context_line":"other VM."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa69d971_0693a450","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":8},"updated":"2016-01-03 12:50:59.000000000","message":"Without one word","commit_id":"0964e387e14f47d8abfc201837e4c65eccdc22c5"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"fe4b96a8b554d6328e72b36a393db89986499c70","unresolved":false,"context_lines":[{"line_number":19,"context_line":"implicitly to each port, these rules are not part of the security groups"},{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With out MAC spoofing protection a VM in a network can pretend and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"},{"line_number":24,"context_line":"other VM."},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa69d971_e9d0a355","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":8},"in_reply_to":"fa69d971_0693a450","updated":"2016-01-03 14:04:46.000000000","message":"Done","commit_id":"0964e387e14f47d8abfc201837e4c65eccdc22c5"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"1923f8ff7b3a7bb33198db15643690057c7416e3","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With out MAC spoofing protection a VM in a network can pretend and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"},{"line_number":24,"context_line":"other VM."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa69d971_66a4e0a5","line":24,"range":{"start_line":24,"start_character":0,"end_line":24,"end_character":9},"updated":"2016-01-03 12:50:59.000000000","message":"What pretend ? You better rephrase.","commit_id":"0964e387e14f47d8abfc201837e4c65eccdc22c5"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"fe4b96a8b554d6328e72b36a393db89986499c70","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With out MAC spoofing protection a VM in a network can pretend and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"},{"line_number":24,"context_line":"other VM."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa69d971_a9caab9f","line":24,"range":{"start_line":24,"start_character":0,"end_line":24,"end_character":9},"in_reply_to":"fa69d971_66a4e0a5","updated":"2016-01-03 14:04:46.000000000","message":"Done","commit_id":"0964e387e14f47d8abfc201837e4c65eccdc22c5"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"f2cffeeb3167b4ed17bccff52b6d8ab975f5972a","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":"In current Neutron implementation MAC spoofing protection rules are added"},{"line_number":19,"context_line":"implicitly to each VM port, these rules are not part of the security groups"},{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Without this protection a VM in a network can spoof and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_ab9ca60f","line":20,"range":{"start_line":18,"start_character":0,"end_line":20,"end_character":8},"updated":"2016-01-05 06:55:14.000000000","message":"I do not see this to be a problem at all.\nSuch rules are added in separate iptables chains.\n(Each iptables chain filters traffic for one VM)","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"2b68adecb0b233d0a219750c370621445275337a","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":"In current Neutron implementation MAC spoofing protection rules are added"},{"line_number":19,"context_line":"implicitly to each VM port, these rules are not part of the security groups"},{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Without this protection a VM in a network can spoof and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_c806bd1c","line":20,"range":{"start_line":18,"start_character":0,"end_line":20,"end_character":8},"in_reply_to":"fa69d971_ab9ca60f","updated":"2016-01-05 07:33:22.000000000","message":"i dont understand what you mean, the purpose of this paragraph is to describe the current state in Neutron, we want to have feature parity with this state. meaning we want to implement this feature in Dragonflow as well..","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"010126533ca683a54569041ce66aaddcae45568f","unresolved":false,"context_lines":[{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Without this protection a VM in a network can spoof and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"},{"line_number":24,"context_line":"other VM."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_294a3bc6","line":23,"range":{"start_line":23,"start_character":49,"end_line":23,"end_character":57},"updated":"2016-01-03 15:06:35.000000000","message":"\"or fakse\" \u003d\u003e \"or send fake\"","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"2b68adecb0b233d0a219750c370621445275337a","unresolved":false,"context_lines":[{"line_number":20,"context_line":"feature."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Without this protection a VM in a network can spoof and answer"},{"line_number":23,"context_line":"to ARP requests that don\u0027t actually belong to it, or fake response for"},{"line_number":24,"context_line":"other VM."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_e81b8171","line":23,"range":{"start_line":23,"start_character":49,"end_line":23,"end_character":57},"in_reply_to":"fa69d971_294a3bc6","updated":"2016-01-05 07:33:22.000000000","message":"i think \"fake response\" is ok too","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":18903,"name":"Yuli","email":"stremovsky@gmail.com","username":"yuli"},"change_message_id":"f2cffeeb3167b4ed17bccff52b6d8ab975f5972a","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":"A new table is added in Dragonflow pipeline for mac spoofing protection."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC src address then the MAC address configured for the VM."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_eb7cdeb6","line":28,"range":{"start_line":28,"start_character":0,"end_line":28,"end_character":72},"updated":"2016-01-05 06:55:14.000000000","message":"Why not a distinct table for each VM Port ?","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"2b68adecb0b233d0a219750c370621445275337a","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Proposed Change"},{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":"A new table is added in Dragonflow pipeline for mac spoofing protection."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC src address then the MAC address configured for the VM."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_685551f8","line":28,"range":{"start_line":28,"start_character":0,"end_line":28,"end_character":72},"in_reply_to":"fa69d971_eb7cdeb6","updated":"2016-01-05 07:33:22.000000000","message":"managing dynamic OpenFlow tables is hard and limiting, also the rules will have matchers based on the in_port so i dont think that performance wise this has much/any effect anyway","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"437d87cd12328aa621130e468bbe17ae9142b89b","unresolved":false,"context_lines":[{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":"A new table is added in Dragonflow pipeline for mac spoofing protection."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC src address then the MAC address configured for the VM."},{"line_number":32,"context_line":"This table can also be used for egress security validations (make sure"},{"line_number":33,"context_line":"to dispatch traffic to a certain VM only if it has the correct configured MAC and IP)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba63e191_c402a13e","line":30,"range":{"start_line":30,"start_character":20,"end_line":30,"end_character":41},"updated":"2016-01-19 03:24:26.000000000","message":"Why only validate mac? It should validate ip-mac pair, I think","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"b9bf82b736c50285024f4078d574f53a69eea9a0","unresolved":false,"context_lines":[{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":"A new table is added in Dragonflow pipeline for mac spoofing protection."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC src address then the MAC address configured for the VM."},{"line_number":32,"context_line":"This table can also be used for egress security validations (make sure"},{"line_number":33,"context_line":"to dispatch traffic to a certain VM only if it has the correct configured MAC and IP)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a68dd71_55907495","line":30,"range":{"start_line":30,"start_character":20,"end_line":30,"end_character":41},"in_reply_to":"ba63e191_c402a13e","updated":"2016-01-27 09:06:34.000000000","message":"Done","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"901878c1a9822b7c0c16721605a432c274ecc269","unresolved":false,"context_lines":[{"line_number":28,"context_line":"A new table is added in Dragonflow pipeline for mac spoofing protection."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC src address then the MAC address configured for the VM."},{"line_number":32,"context_line":"This table can also be used for egress security validations (make sure"},{"line_number":33,"context_line":"to dispatch traffic to a certain VM only if it has the correct configured MAC and IP)"},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_82723eac","line":31,"range":{"start_line":31,"start_character":35,"end_line":31,"end_character":39},"updated":"2016-01-18 09:10:10.000000000","message":"should be \"than\"","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"b9bf82b736c50285024f4078d574f53a69eea9a0","unresolved":false,"context_lines":[{"line_number":28,"context_line":"A new table is added in Dragonflow pipeline for mac spoofing protection."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC src address then the MAC address configured for the VM."},{"line_number":32,"context_line":"This table can also be used for egress security validations (make sure"},{"line_number":33,"context_line":"to dispatch traffic to a certain VM only if it has the correct configured MAC and IP)"},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a68dd71_758b3869","line":31,"range":{"start_line":31,"start_character":35,"end_line":31,"end_character":39},"in_reply_to":"da6ed579_82723eac","updated":"2016-01-27 09:06:34.000000000","message":"Done","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"a85ba8efd7c12f3151eec7df2cafa0ddae398bcb","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Additional drop rules:"},{"line_number":39,"context_line":"1) Packets with SRC MAC broadcast/multicast bit set."},{"line_number":40,"context_line":"2) VLAN tagged frames where the TCI \"Drop eligible indicator\" (TEI) bit is set (congestion)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_9d65611f","line":40,"range":{"start_line":40,"start_character":8,"end_line":40,"end_character":14},"updated":"2016-01-05 11:07:07.000000000","message":"Do we want to allow a VM to do VLAN tagging ?\n\nI think that by default we should drop any traffic with VLAN tagging by the VM (maybe add a parameter for administrator to allow this )","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"08464ecc88f694e5ecc24407607ec7c5f1066f19","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Additional drop rules:"},{"line_number":39,"context_line":"1) Packets with SRC MAC broadcast/multicast bit set."},{"line_number":40,"context_line":"2) VLAN tagged frames where the TCI \"Drop eligible indicator\" (TEI) bit is set (congestion)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_5f972590","line":40,"range":{"start_line":40,"start_character":8,"end_line":40,"end_character":14},"in_reply_to":"fa69d971_1ef01dc9","updated":"2016-01-13 06:43:30.000000000","message":"I agree following the enable disable settings of  Vlan trunk","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"c9e8362fb1f80ae3fba86858fd3b256f4f67f83d","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Additional drop rules:"},{"line_number":39,"context_line":"1) Packets with SRC MAC broadcast/multicast bit set."},{"line_number":40,"context_line":"2) VLAN tagged frames where the TCI \"Drop eligible indicator\" (TEI) bit is set (congestion)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_e2a123f9","line":40,"range":{"start_line":40,"start_character":8,"end_line":40,"end_character":14},"in_reply_to":"fa69d971_324a5fad","updated":"2016-01-06 10:26:53.000000000","message":"trunking port is common in NFV. I think we do not need drop it. Or we set an option to enable/disable it.","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11364,"name":"Fei Rao","email":"milo.frao@gmail.com","username":"milo.frao"},"change_message_id":"1b97af338da9010a7c0d533096e9d7080a850e9e","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Additional drop rules:"},{"line_number":39,"context_line":"1) Packets with SRC MAC broadcast/multicast bit set."},{"line_number":40,"context_line":"2) VLAN tagged frames where the TCI \"Drop eligible indicator\" (TEI) bit is set (congestion)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_1ef01dc9","line":40,"range":{"start_line":40,"start_character":8,"end_line":40,"end_character":14},"in_reply_to":"fa69d971_9d65611f","updated":"2016-01-07 11:41:13.000000000","message":"Agree with Ma Li, port Vlan trunk feature has already started in Mitaka. so I think we need according to Vlan trunk enable/disable to pass/drop the tagging frame from VM.","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"0459fc6d96c2e7cfc03dd2abde1af67425fb59c2","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Additional drop rules:"},{"line_number":39,"context_line":"1) Packets with SRC MAC broadcast/multicast bit set."},{"line_number":40,"context_line":"2) VLAN tagged frames where the TCI \"Drop eligible indicator\" (TEI) bit is set (congestion)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_324a5fad","line":40,"range":{"start_line":40,"start_character":8,"end_line":40,"end_character":14},"in_reply_to":"fa69d971_9d65611f","updated":"2016-01-05 11:47:34.000000000","message":"why not?","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11364,"name":"Fei Rao","email":"milo.frao@gmail.com","username":"milo.frao"},"change_message_id":"1b97af338da9010a7c0d533096e9d7080a850e9e","unresolved":false,"context_lines":[{"line_number":85,"context_line":"that Dragonflow is currently not a ML2 plugin, we still would like a way"},{"line_number":86,"context_line":"to disable/enable port security for a certain port."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"L2 ARP Supression"},{"line_number":89,"context_line":"------------------"},{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_de80454c","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":17},"updated":"2016-01-07 11:41:13.000000000","message":"I think dhcp spoofing should be processed in port security or dhcp table. I find current implement is that all the dhcp packets(as client or server) will be forwarded to df-controller directly. Although dhcp spoofing cannot occur to other VMs, but huge dhcp packet may cause DOS attack to the Controller. These dhcp packets as server should not be forwarded to controller. and should be dropped in advance.","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":7805,"name":"Li Ma","email":"skywalker.nick@gmail.com","username":"Nick"},"change_message_id":"76ddf226a82571880a81ecfb62a433e03a4bbfd0","unresolved":false,"context_lines":[{"line_number":85,"context_line":"that Dragonflow is currently not a ML2 plugin, we still would like a way"},{"line_number":86,"context_line":"to disable/enable port security for a certain port."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"L2 ARP Supression"},{"line_number":89,"context_line":"------------------"},{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_b87fd2de","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":17},"in_reply_to":"da6ed579_ff4db999","updated":"2016-01-15 08:08:02.000000000","message":"+1","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"901878c1a9822b7c0c16721605a432c274ecc269","unresolved":false,"context_lines":[{"line_number":85,"context_line":"that Dragonflow is currently not a ML2 plugin, we still would like a way"},{"line_number":86,"context_line":"to disable/enable port security for a certain port."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"L2 ARP Supression"},{"line_number":89,"context_line":"------------------"},{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_224b522d","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":17},"in_reply_to":"fa69d971_de80454c","updated":"2016-01-18 09:10:10.000000000","message":"+1","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"0bd004cd173dff277e4b0f4d2261b3b0d86c82dc","unresolved":false,"context_lines":[{"line_number":85,"context_line":"that Dragonflow is currently not a ML2 plugin, we still would like a way"},{"line_number":86,"context_line":"to disable/enable port security for a certain port."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"L2 ARP Supression"},{"line_number":89,"context_line":"------------------"},{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa69d971_df226e01","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":17},"in_reply_to":"fa69d971_de80454c","updated":"2016-01-07 18:49:27.000000000","message":"You raise a good point, we thought about this scenario that the VM has ability to DOS attack the controller with DHCP traffic, we do need to solve this as part of the DHCP application, the blocking flows can be located as you suggested in this spoofing table (port security table)","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":13070,"name":"Eran Gampel","email":"eran@gampel.net","username":"Gampel"},"change_message_id":"08464ecc88f694e5ecc24407607ec7c5f1066f19","unresolved":false,"context_lines":[{"line_number":85,"context_line":"that Dragonflow is currently not a ML2 plugin, we still would like a way"},{"line_number":86,"context_line":"to disable/enable port security for a certain port."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"L2 ARP Supression"},{"line_number":89,"context_line":"------------------"},{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da6ed579_ff4db999","line":88,"range":{"start_line":88,"start_character":0,"end_line":88,"end_character":17},"in_reply_to":"fa69d971_df226e01","updated":"2016-01-13 06:43:30.000000000","message":"Very good point I agree we should block the DHCP spoofing in the port security table to avoid DOS attack on the controller","commit_id":"2af6ca712d9157ef567506231adf2678465f8412"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"4fb24a016c048460faabbda090a2adeebce1695e","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC-IP validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC-IP src address than the MAC-IP address configured for the VM."},{"line_number":32,"context_line":"This table can also be used for egress security validations (make sure"},{"line_number":33,"context_line":"to dispatch traffic to a certain VM only if it has the correct configured MAC and IP)"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"It will also have rules allowing DST broadcast/multicast MAC traffic"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_5e3f4bb4","line":32,"range":{"start_line":32,"start_character":32,"end_line":32,"end_character":38},"updated":"2016-01-28 06:28:11.000000000","message":"Should be Ingress. Why should we drop the packets instead of the dst vm? I think for port security, we only need to validate the src ip-mac pair. If the dst ip and mac pair is wrong, let the dst vm drop it. Not us. At least not port security","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"326cc0e3e56254174b3154da57972f38f1d19b0b","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This table will have MAC-IP validation rules which blocks any traffic"},{"line_number":31,"context_line":"that has different MAC-IP src address than the MAC-IP address configured for the VM."},{"line_number":32,"context_line":"This table can also be used for egress security validations (make sure"},{"line_number":33,"context_line":"to dispatch traffic to a certain VM only if it has the correct configured MAC and IP)"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"It will also have rules allowing DST broadcast/multicast MAC traffic"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_5c06f31d","line":32,"range":{"start_line":32,"start_character":32,"end_line":32,"end_character":38},"in_reply_to":"7a5de9d1_5e3f4bb4","updated":"2016-01-31 11:40:31.000000000","message":"i agree with this point","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":17609,"name":"steve","email":"ruansx@cn.ibm.com","username":"steve.ruan"},"change_message_id":"9d7619e43ee2a5004be61b841bf5b99ebbb6820f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"     match:vlan_tci\u003d0x1000/0x1000 actions\u003ddrop"},{"line_number":45,"context_line":"     match:dl_src\u003d01:00:00:00:00:00/01:00:00:00:00:00 actions\u003ddrop"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"     match:metadata\u003d0x2,dl_src\u003dfa:16:3e:d6:87:a7 actions\u003dresubmit(,\u003cnext_table\u003e)"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_72d0a8c9","line":45,"range":{"start_line":45,"start_character":5,"end_line":45,"end_character":10},"updated":"2016-02-01 09:34:04.000000000","message":"In most case, source mac will not be multicast address. But for some case, it will be.\nFor example,\nhttp://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-config-catalyst-00.html#mm","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"6a841e4690c26f786b1258fb5984e87354aa2ef8","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"     match:vlan_tci\u003d0x1000/0x1000 actions\u003ddrop"},{"line_number":45,"context_line":"     match:dl_src\u003d01:00:00:00:00:00/01:00:00:00:00:00 actions\u003ddrop"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"     match:metadata\u003d0x2,dl_src\u003dfa:16:3e:d6:87:a7 actions\u003dresubmit(,\u003cnext_table\u003e)"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_74304ae9","line":45,"range":{"start_line":45,"start_character":5,"end_line":45,"end_character":10},"in_reply_to":"7a5de9d1_72d0a8c9","updated":"2016-02-02 13:38:56.000000000","message":"We dont want VMs to send traffic with SRC MAC address, the link refers to a physical appliance, so not sure if its really relevant here.\nWhat is the use case for VM to send multicast src traffic? maybe you can elaborate a bit more on that.","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"dc1dace5f6ebd7c0260d23e2dc2bfbf17a2ad70b","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Following are examples for the flows configured in that table::"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"     match:vlan_tci\u003d0x1000/0x1000 actions\u003ddrop"},{"line_number":45,"context_line":"     match:dl_src\u003d01:00:00:00:00:00/01:00:00:00:00:00 actions\u003ddrop"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"     match:metadata\u003d0x2,dl_src\u003dfa:16:3e:d6:87:a7 actions\u003dresubmit(,\u003cnext_table\u003e)"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_14cf96b4","line":45,"range":{"start_line":45,"start_character":5,"end_line":45,"end_character":10},"in_reply_to":"7a5de9d1_74304ae9","updated":"2016-02-02 13:42:02.000000000","message":"The link you provided seems to talk about destination multicast ip, unless i missunderstood","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"4fb24a016c048460faabbda090a2adeebce1695e","unresolved":false,"context_lines":[{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"},{"line_number":92,"context_line":"to respond to ARP requests and no ARP traffic should actually reach a VM."},{"line_number":93,"context_line":"We still need to verify that this also block gratitude ARPs."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Blocking invalid broadcast/multicast traffic"},{"line_number":96,"context_line":"---------------------------------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_fedb9719","line":93,"range":{"start_line":93,"start_character":0,"end_line":93,"end_character":59},"updated":"2016-01-28 06:28:11.000000000","message":"Why should arp responder flows block gratitude arps? I think arp responder is only for requests from vms, while gratitude arps is when a vm needs to tell other vms to refresh their arp entry of it. If we block gratitude arps, then the old arp entry could not be updated immediately","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"326cc0e3e56254174b3154da57972f38f1d19b0b","unresolved":false,"context_lines":[{"line_number":90,"context_line":"It is also important to note that with full ARP L2 suppression [2], some of"},{"line_number":91,"context_line":"the features described here are not needed as OVS flows are used"},{"line_number":92,"context_line":"to respond to ARP requests and no ARP traffic should actually reach a VM."},{"line_number":93,"context_line":"We still need to verify that this also block gratitude ARPs."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Blocking invalid broadcast/multicast traffic"},{"line_number":96,"context_line":"---------------------------------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_91045418","line":93,"range":{"start_line":93,"start_character":0,"end_line":93,"end_character":59},"in_reply_to":"7a5de9d1_fedb9719","updated":"2016-01-31 11:40:31.000000000","message":"the idea here was that we need to block \"fake\" gratitude ARPs, even when we have ARP suppression.","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":18668,"name":"ding bo","email":"longddropt@163.com","username":"longddropt"},"change_message_id":"4fb24a016c048460faabbda090a2adeebce1695e","unresolved":false,"context_lines":[{"line_number":98,"context_line":"We drop traffic that has the same src and dst ports classified (the src port register"},{"line_number":99,"context_line":"and the dst port register are same)."},{"line_number":100,"context_line":"This scenario happens when we handle broadcast/multicast traffic and just"},{"line_number":101,"context_line":"duplicate packet few times for every port in the broadcast domain or"},{"line_number":102,"context_line":"multicast group."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"DHCP protection"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_fe4957d1","line":101,"range":{"start_line":101,"start_character":31,"end_line":101,"end_character":65},"updated":"2016-01-28 06:28:11.000000000","message":"include the src port?","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"},{"author":{"_account_id":11343,"name":"Gal Sagie","email":"gal.sagie@gmail.com","username":"GalSagie"},"change_message_id":"326cc0e3e56254174b3154da57972f38f1d19b0b","unresolved":false,"context_lines":[{"line_number":98,"context_line":"We drop traffic that has the same src and dst ports classified (the src port register"},{"line_number":99,"context_line":"and the dst port register are same)."},{"line_number":100,"context_line":"This scenario happens when we handle broadcast/multicast traffic and just"},{"line_number":101,"context_line":"duplicate packet few times for every port in the broadcast domain or"},{"line_number":102,"context_line":"multicast group."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"DHCP protection"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a5de9d1_11106458","line":101,"range":{"start_line":101,"start_character":31,"end_line":101,"end_character":65},"in_reply_to":"7a5de9d1_fe4957d1","updated":"2016-01-31 11:40:31.000000000","message":"currently we include the src port for easier managment, so we should drop this case as part of this port security, its a simple block per port","commit_id":"141bd4693ef1124884383e04ea147871cfdbb903"}]}